Maze Ransomware Authors Name and Shame Victims

Maze Ransomware Authors Name and Shame Victims

After a string of attacks against major organizations worldwide, the Maze group has begun dumping victim data publicly online, in an effort to shame victims who did not meet their demands. This name-and-shame technique may make victims more likely to pay ransoms, which ultimately increases the profitability of ransomware and makes it much more appealing to attackers.

Recommendations

• Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat
• Ensure defensive systems are up to date with the latest detection
• Blacklist network infrastructure associated with this campaign
• Remain alert to potential phishing attacks on social media, and avoid downloading suspicious email attachments

Details

The authors behind Maze ransomware have implemented an interesting new tactic to get their victims to pay up - naming and shaming them on a public website. The site lists victims, along with publicly downloaded “proof” files containing sensitive information related to the breached organization. The site also lists locked IP addresses, the date of compromise, and the total amount of data encrypted.

Figure 1. Maze group’s victim-shaming website banner

The Maze group has targeted organizations within a variety of industries, based in countries across the world. The latest publicized attack is against the City of Pensacola, Florida. When the city refused to pay the $1 million ransom, the group responded by dumping 2 GB of stolen data online. Purportedly, this is just 2 GB out of a total of 32 GB of stolen data.

The Maze group is not the only group extorting their victims in this way, however. Plenty of other ransomware groups have also begun using this tactic, in the hopes of increasing the likelihood that their victim pays the ransom. In May 2019, the Twitter account supposedly belonging to the person behind the Baltimore City ransomware attack provided proof of the attack in the form of court documents posted publicly. The same user also posted several tweets directed at the mayor of Baltimore, demanding the mayor pay up.

Similarly, Team Snatch also employed a name-and-shame approach when they compromised CityComp in May 2019. This kind of extortion may ultimately increase the likelihood that ransomware victims meet the demands of their attackers. ZeroFOX highly recommends taking the precautions detailed in this advisory to mitigate risk of being compromised.